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Abstract 

In [17,19] Peter Hancock and Anton Setzer introduced rules to extend Martin-Lof’s 
type theory in order to represent interactive programming. The rules essentially re¬ 
flect the existence of weakly final coalgebras for a general form of polynomial functor. 
The standard rules of dependent type theory allow the definition of inductive types, 
which correspond to initial algebras. Coalgebraic types are not represented in a di¬ 
rect way. In this article we show the existence of final coalgebras in intensional type 
theory for these kind of functors, where we require uniqueness of identity proofs 
(UIP) for the set of states S and the set of commands C which determine the func¬ 
tor. We obtain the result by identifying programs which have essentially the same 
behaviour viz are bisimular. This proves the rules of Setzer and Hancock admissi¬ 
ble in ordinary type theory, if we replace definitional equality by bisimulation. All 
proofs 2 are verified in the theorem prover agda [6,36], which is based on intensional 
Martin-Lof Type Theory. 
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1 Introduction 


Martin-Lof type theory [28,34] is a very carefully developed framework for 
constructive mathematics. It is well suited as a theory for program construc¬ 
tion since it is possible to express both specification and programs within the 
same formalism. Types in Martin-Lof type theory can be seen as program 
specifications via the proposition-as-types interpretation. Inhabitants of these 
types are programs which fulfil the required specification. Running such a 
program means to evaluate an expression. One of the design features of the 
framework is that the evaluation of a well-typed program always terminates. 
Further there is no interaction with the environment. In order to introduce 
interaction into type theory and to allow the non-termination of programs, 
Hancock and Setzer [17,19] introduced the notions of (state dependent) in¬ 
terfaces and interactive programs. Their approach results in an extension of 
type theory by rules expressing the existence of weakly final coalgebras for the 
functors determined by interfaces. This coalgebraic rules give a comfortable 
way to reason about interactive programs. However coalgebraic types are not 
represented directly in standard type theory. In fact they are classical exam¬ 
ples of impredicative conceptions whereas Martin-Lof type theory is a strictly 
predicative theory. Predicative type theories play a particular role for giving 
foundational interpretations of programming languages. They have multiple 
mathematical models, notably set theoretic, PER models and denotational 
models, that provide precise definitions of programming language features, 
due to their explicit inductive construction. 

On the other side one has to be careful adding rules to type theory. That this 
may have disastrous consequences can be seen e.g. in Martin-Lof’s Mathe¬ 
matics of Infinity [29] where it is shown that type theory becomes inconsistent 
when the formal laws for the fixed point operator are adjoined to it. 

However in this work we show that it is possible to reason about interac¬ 
tive programs in standard predicative type theory as long as we replace the 
definitional equality in the rules [17,19] by bisimulation. This is done by con¬ 
structing final coalgebras for the functors mentioned above. The basic idea 
for this construction is essentially the same as for the model construction in 
Michelbrink/Setzer [33]. However the proof that there is a final coalgebra for 
this kind of functors is surprisingly hard. This is due to the fact that we work 
in intensional type theory, where we have to deal with the problem that types 
depending on propositionally equal elements may not be equal. However un¬ 
like the extensional version intensional type theory has a number of desirable 
features we do not want to miss: all well-typed expressions normalise and 
well-typedness, type-hood, type-checking as well as definitional equality are 
decidable. 

The theory of types developed by Per Martin-Lof “is intended to be a full scale 
system for formalizing intuitionistic mathematics” [30]. As a foundational the¬ 
ory it is thought to be open-ended, in the sense that we might extend it by 
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rules for new types provided the informal semantic principles of the theory are 
respected. In this article we work with an extension of Martin-Lof type theory 
that accommodates inductive-recursive definitions. A first example of simul¬ 
taneous induction-recursion is Martin-Lof’s definition of the first universe a la 
Tarski [28]. The general schema for this kind of definition is introduced and 
investigated by Peter Dybjer [9]. 

The paper is organised as follows. In section 2 we restate the original defi¬ 
nition of interfaces and programs, try to explain the concept of intensional 
identity, the meaning it has for constructive reasoning and describe the dif¬ 
ficulties which arise using this concept. We discuss families and predicates 
and how they are related and give a new modified definition of interfaces. In 
section 3 we introduce our category and in the following section 4 the endo- 
functor Prog on this category, for which we are going to show that there is 
a final coalgebra in the category. In section 5 we define a coalgebra for this 
functor, which consist in a family of sets CT, equivalence relations on this sets 
and a morphism elim : CT —> Prog CT. In section 6 we introduce the unique 
morphism. However to prove that the function defined indeed belongs to the 
category and that it is the unique morphism making the coalgebra square com¬ 
mute we have to do some more work. In section 7 we define the repetition of 
the unique morphism and prove our Main Lemma. The Main Lemma is then 
used to prove that the morphism defined in section 6 belongs to the category 
(is extensional) and is the unique morphism making the diagram commute. 
In section 8 we point out how to get a final coalgebra for the original functor 
of Hancock/Setzer from this. In section 10 we conclude by describing some 
future and related work. 

We use the following notations: t t' for t evaluates to t',t t' for t, t' eval¬ 
uate to the same value, A for the type A is inhabited, id : t = t' or id : t =a t' 
for id is an inhabitant of the identity type. We use the notation (x : A) —> B x 
for the product type and sig m 0 : A 0 , ..., m n : A n m 0 ... m n _! for sigma 
types where the components of a : sig m 0 : A 0 , ..., m n : A n m 0 ... m n _i are 
accessed via a mi for i — (),..., n. We denote the canonical elements of the 
sigma types by (a 0 ,..., a n ) and abbreviate sig fst : A, snd : B fst by X)(A, 5) 
or 1j£(x : 21.-5 x ) to emphasise x. The sentential connectives V, 3, A, V, =A for 
this type constructors are used in the standard way to emphasise the read¬ 
ing of types as propositions. We sometimes suppress arguments which can 
be inferred from other arguments for instance we write subst id b instead of 
subst A B a a! id b. We also use the notation _ for missing arguments. We 
use the notations False and True for the type with zero and one canonical ele¬ 
ment respectively. To improve readability we overload some function symbols 
e.g. st, co. However functions denoted by equal symbols have equal codomains 
whereas the argument types may be different. 
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2 Basic definitions and concepts 


2.1 Interfaces and interactive programs 


In [17] Hancock and Setzer give the following definition of an interface: 

An interface is a quadruple (S, C, R, n) s.t. 

• S : Set 

• C : S -► Set 

• R : (s : S, C s) ■-> Set 

• n : (s : S, c : C s, R s c) —»■ S. 

The elements of the set S are called states, C s is the set of commands in 
state s : S, R s c the set of responses to a command c : C s in state s : S, and 
user the next state of the system after this interaction. 

A program for this interface starting in state s : S is a quadruple ( A , c, next, a) 
s.t. 

• A : S -> Set 

. c:(s:S,As)^Cs 

• next : (s : S, a : A s, r : R s (c s a)) —> A (n s (c s a) r) 

• a : A s. 

The elements of the set A s are understood as programs starting in the state 
s. The command c s a is the command issued by the program a : A s, and 
next s a r is the program that will be executed, after having obtained for 
command c s a the response r : R s (c s a). The execution of a program 
a : A s proceeds as follows. First we compute c s a and issue this command. 
Then we wait for a response r : R s (c s a) from the real world. When we 
have obtained a response r we compute the new program next s a r. This 
cycle is repeated until we reach a command c with no responses. It may be 
undecidable if this is the case. It should also be noted that a program may 
wait forever for a response. See [17] for further motivations. 

Note that in the definition above programs are given by arbitrary families of 
sets A : S —> Set. That means the whole range of sets can be used to introduce 
elements into the set of all programs. In particular the set of programs itself 
may be used. This is a violation of the vicious-circle principle: impredicative 
definitions should not be used. That is, an object should not be defined in 
terms of a totality to which the object itself belongs. In other words no totality 
can contain members defined in terms of itself. The vicious-circle principle is 
taken very seriously in Martin-Lof type theory. 

If we combine c s a and next s a we get an element of Prog HS A s := ]T(c : 
C s.(r : R s c) —> A (ns c r)). Since there is no way to get the set of all 
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programs directly in a predicative framework, Hancock and Setzer expanded 
Martin-Lof type theory. This results in a type theory where the adjoined rules 
express the existence of a (weakly) final coalgebra for the functor Prog HS . 

We are going to show that under certain assumptions on the sets of states and 
commands the existence of this set of programs can be proved in ordinary type 
theory. The proof is surprisingly hard. The reason for this is that we work in 
intensional type theory. 


2.2 Intensional Identity 


Under the proposition-as-types interpretation, propositions are nothing other 
than types. That a proposition is true means that the type is inhabited. In 
order to have an internal representation of equality identity types are intro¬ 
duced. The main purpose of this identity types is to be able to make the 
assumption that two objects of a type are identical, i.e. to express identity 
of objects on the left side of an implication. Martin-Lof’s type theory can be 
formulated on top of a theory of logical types (logical framework) [34]. This 
is a typed A/dry-calculus with dependent function types, a special type Set and 
a rule which states that each object of Set is also a type. Sets are given by 
formation, introduction, elimination and equality rules. The formation rules 
say how to build sets, the introduction rules say what the canonical elements 
of the set are. Elimination and equality rules say how to eliminate set formers. 
/3- and r ]-conversion together with the equality rules give definitional equality. 
There are two main versions of Martin-Lof type theory: extensional and in¬ 
tensional type theory. The difference lies in the treatment of the identity type. 
In both versions the formation and introduction rules of the identity type are 
the same: 


A : Set a, b : A A : Set a: A 

a= A b : Set refl a : a = A a 

The difference is in the elimination and equality rules for the identity type. 
The elimination rules in extensional type theory identify propositional and 
definitional identity: 


p ■ a= A b 
a = b : A 

This renders type-theory undecidable, i.e. well-typedness, type-checking, type- 
hood and definitional equality become undecidable [22]. This is in contrast to 
intensional type theory. There is a deep symmetry between the introduction 
rules on the one side and the elimination and equality rules on the other side in 
intensional type theory. The elimination rules for all sets can be understood 
as structural induction rules: A proposition is true for all elements iff the 
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proposition is true for the canonical elements of the set. In fact elimination 
and equality rules can be calculated from the introduction rules [8]. This holds 
as well for the identity type: 


C : (x, y : A,p : x = A y) -»• Set 
c : {x : A) —* C x x (refl x) a,b : A p : a =a b 
idpeel Ccabp:Cabp 


with equality idpeel C c a a (refl a) = c a. Surprisingly this very weak elimi¬ 
nation rule allows to deduce the usual properties of equality, notably Leibniz’ 
principle (C a implies C b for a = b). However working with intensional 
identity becomes very awkward. The reason for this is that propositional and 
definitional equality do not collapse. That is, two instances of a type family 
with indices which are not convertible, just propositionally equal, are not the 
same type, i.e. c : C a is in general not an element of C b if a equals b, though 
if p : a = b and c : C a we get an element subst pc: C b. The trouble is that 
this element depends on the proof p and there is no general way to conclude 
that subst p c equals subst q c for p, q : a = b. 

We frequently use the following well known (and easy to prove) principles: 


Principle 1 


for A, B : Set, / : A 


a 0 = ax ^ f o 0 = / ai 
B, a 0 , oq : A. 


Principle 2 


(a 0 , b 0 ) =^ a ,b) («i> b i) a o =a ai A b 0 = Bai h 

for A : Set, B : A —► Set, a* : A,bi : Bi, i = 0,1 and b 0 obtained from b 0 by the 
inhabitant of a 0 = oq. 


2.3 Families and predicates 


What makes type theory into dependent type theory is that types may depend 
on elements of other types. A family of sets is given by a set IndexP and 
a function P : IndexP —> Set. The function P may as well be seen as a 
predicate on IndexP. On the other hand it is often technically simpler to 
work with a more hbration-like view of families: A family is given by two sets 
CoIndexF, IndexF and a function F : CoindexF —> IndexF. We call the 
former predicate and the latter family. It is possible to switch between these 
notions in the following ways: From predicate P to family F (pr 0 denotes the 
first projection): 
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CoIndexF := ^ (IndexP, P) 

IndexF := IndexP 

F : = pr 0 : y](/rerfexP, P) —> IndexP. 

From family F to predicate P define IndexP := IndexF and let P i be given 
by the following rules: 

Formation Introduction Elimination 

i : IndexF d : P i 

i : IndexF c : CoIndexF B : (i : IndexF, d : P i) -► Set 

Pi'. Set intro c : P (F c) b : (c : CoIndexF) —> B (F c) (intro c) 

elim B bi d : B i d 

where elim B b (F c) (intro c) evaluates to b c. Note that the latter gives 
exactly the rules for intensional identity if we take as family A : A —> A x A 
with A a := (a, a). We write PredToFam P and FamToPred F for the predicate 
respectively family we gain by the way above. Intuitively we can think about 
FamToPred F as the pre-image function F _1 . 

We say that / : A —> B is a bijection iff there is a g : B —> A such that 
a — (g(f a)) and b — ( f(g b)) are inhabited for all a : A, b : B. We write 
A ~ B iff there is such a bijection. It is easy to establish the following bijec- 
tions: 

P i ~ FamToPred (PredToFam P ) i 
iso : CoIndexF ~ (PredToFam (FamToPred F)) Co indexF- 
In the second case the functions pr 0 o iso = (PredToFam (FamToPred F)) o iso 
and F are pointwise equal. 

There is a second approach to get a predicate P from a family F. This approach 
uses the identity set: Define IndexP := IndexF and 

P i := ]T(c : CoIndexF, (F c) = i ) 

for i : IndexF. We write FamToPred' F for this predicate. Again it is not too 
hard to establish the following bijections: 

P i ~ FamToPred' (PredToFam P ) i 

iso : CoIndexF ~ (PredToFam (FamToPred' F)) Co indexF 
and to prove that in the second case the functions pr 0 o iso = 
(PredToFam (FamToPred' F)) o iso and F are pointwise equal. Note that the 
index set stays the same all the time and that 

FamToPred (PredToFam P) i ~ FamToPred' (PredToFam P) i 

(PredToFam (FamToPred F)) Co index — (PredToFam (FamToPred' F)) Co indexF- 
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This is a little bit remarkable since the second approach seems to multiply 
elements due to the fact that there may be more than one inhabitant of (F c ) = 
i. The phenomenon is related to the fact that we can prove 

Collapse ^(a : A, a = a') 
for a' : A but in general not 


Collapse (a = a') 

for a, a' : A where Collapse A is Va, a' : Aa = a'. 


2-4 A simpler definition of interfaces 


What makes work with the interface definition above clumsy is that there are 
too many dependencies. The commands depend on the states, the responses on 
the commands and the next state on the state, the command and the response. 
This seems to be redundant since the information to which state a command 
belongs should already be given by the command itself and similarly for the 
responses and the next state. Hence the responses should depend only on the 
command and the next state on the response. The way to achieve this is to 
work with families instead of predicates: 

Definition 3 Interface 

An interface is given by sets S, C, R and functions st : C —> S, co : R —> C, 

nxt : R —■> S. 

Given an interface ( S,C,R,n ) in the sense of Hancock/Setzer we get an in¬ 
terface in the new sense by 


st := PredToFam C 


co := PredToFam R' 


and setting 


nxt(((s, c), r)) := n s cr 


where R' is the uncurried version of R. The altered definition determines a 
functor (see section 4 below). We are going to prove that this functor has 
a final coalgebra and use this result to get a final coalgebra for the original 
functor of Hancock/Setzer above. However we have not succeeded to prove the 
result in its most general form for arbitrary sets S, C. In order for the proof to 
go through we need a principle known as uniqueness of identity proofs on the 
sets S, C. This principle states that all the inhabitants of a = a' are identical, 
that is 


Va, a' : A. Collapse (a = a'). 



We write UIP A for Va, a' : A. Collapse (a = a'). As shown by Martin Hofmann 
[21,22] UIP A is not provable for arbitrary sets A. However it is provable for 
the enumeration types, the natural number type and preserved by the identity 
type and the sum type constructors [21], that is 

UIP A Va, a' : A.UIP (a = A a ') 


and 

UIP A => (Va : AUIP B a) => UIP £(A, B). 

More general UIP A follows from decidability of identity [20] that is 

Va, a' : A. (a =a a!) V (a ^ a a!) 

which is also preserved by the sum type constructor. Streicher [41] noticed 
that UIP A is provable if in the elimination rules for the identity type above 
the type of C is changed from (x,y : A,p : x =a y) —*► Set to (x : A,p : x =a 
x) —> Set. Using this elimination rule is equivalent to pattern matching [31], 
which therefore proves UIP as well. However in this cases elimination can not 
be justified as structural induction. In the following we assume UIP for the 
sets S and C. 


3 The category of S-indexed families of setoids 


We are going to define the category of S-indexed families of setoids. The 
ambient category of setoids is a model of intensional type theory [21]. The set 
of states S determines the following (presheaf-)category: 

Objects are triples 

A : S —> Set 

= x : (s:S,Is,I s) —> Set 
eq x : (s : S) —> equivalence (= x s) 

where equivalence R says that R is an equivalence (reflexive, transitive, sym¬ 
metric) relation. 

We use the notations =, = x and = s for the binary relation (s : S) 

=x s C X s x X s. 


We say =x- (s : S) — > X s —> X s —> Set is an equivalence relation iff all 
relations = S Q X s x X s are equivalence relations. Morphism / : ( X , = x 
, eq x ) —> (Y, =y, eq y ) are given by a family of S-indexed extensional functions 
in the sense that 

f :(s:S)^X s^Y s 


and 


x = x x' =>• / s x = Y f s x' 
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for s : S, x,x' : X s. We use the same notation for the morphism and the 
function /. If we want to emphasise the relations =x, =y we sometimes say 
that / is (=x, =y)-extensional. We identify /, g : (W, =j^, eq x ) —» (Y, = y , eq y ) 
iff 

x = x x' ^ f s x = Y g s x' 

for all s : S, x, x' : X s. 

It is easily verified that this gives a category. 


4 The Endofunctor Prog 


The interface (S, C, R, st, co, nxt) determines the endofunctor Prog given by 

Prog X s : Set 
= sig command : C 
id^ 0 : (st c) = s 

next E i : (r : R, (co r) = c) —> W(nxt r) 
for X : S ^ Set with equivalence relation 


Prog =x s ( c 0 ,ids 0 ,fo) (ci,*dsi,/i) : Set 
= sig idc : c 0 = ci 

fct : (r : R, idcr : (co r) = c 0 ) —*> /o r idcr =( nx t r) fi r idcr' 

where idcr' := subst idc idcr. We use the notation =p rog for this relation. By 
some simple calculations it follows that =p ro g is an equivalence relation if = is 
an equivalence relation. We allow some abuse of notations. Prog takes a family 
of sets X : S — > Set, an equivalence relation = x on X and a witness for the 
fact that =x is an equivalence relation and gives a triple consisting of a family 
of sets Prog X : S — > Set an equivalence relation Prog =x on Prog X and a 
corresponding witness. 

The morphism part of the functor Prog is given by 


Prog g s : Prog Is-» Prog Y s 

Prog g s (c, ids, f) — (c, ids, Xr : R, idc : (co r) = c. g (nxt r) (/ r idc)) 
If g is extensional then Prog g is extensional too. To see this, let 
(c 0 ,ids 0 ,fo) =Pro g <ci, idsi,fi) 3 . 

3 Remember that this means that the type is inhabited. 
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Then we have idc : c 0 = C\. Let r : R and idcr : (co r) = c 0 . We have 
fo rider = {nxtr ) hr idcr' 

where idcr' is obtained from idcr by idc. We must show that 

g (nxt r) (/ 0 r idcr) =( nxt r) g (nxt r) (/i r idcr'). 

But this follows by the extensionality of g. 

The defining properties for a functor are easily verified. 


5 The coalgebra of computation trees 


A possible first approach 4 to construct a final coalgebra representing the 
programs of Hancock/Setzer might be to work in the category of setoids 
[21,11]- The final coalgebra for the functor Prog ought to be defined by means 
of the set (List R) —> C together with an appropriate equivalence relation. 
Given a morphism g : B —> Prog B the idea is now to define an element 
tree g j, : (List R) — > C for b : B by 

(9 ^[command 

j (9 b') command if co r = tree g , b l 
[some “junk” otherwise 

where b' has to be defined simultaneously by means of (g )next E i- However 
this approach does not work. The reason is that we do not have c = c' V 
c ^ d for c, d : C in general, i.e. identity on C must not be decidable. As a 
consequence we can not define tree g , b by case distinction as above. Instead we 
have to prove our envisaged result by doing it the hard way 5 : We are going to 
define the object of the final coalgebra as a set of trees containing exactly the 
information a program needs to have. These trees are represented by functions 
on dependent lists of states, commands and responses into a universe. We start 
by defining the set of lists: 

Definition 4 Elements of CTSeq s for s : S are either of the form 


tree gfi () := 
tree 9jb ( l,r ) := 


4 One of the referees of this paper suggested to explore this idea. 

5 “... the dwarfs found out how to turn lead into gold by doing it the hard way. 
The difference between that and the easy way is that the hard way works.” Terry 
Pratchett, The Truth, 2000. 
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where c : C and ids : st c = s, or of the form 

(l, r, idc, c, ids) 

where l : CTSeq s, r : R, idc : co r = co -l, c : C, ids : st c = nxt r and co -l 
denotes the last command of the sequence l, i.e. 

co _ (c, ids ) = co _ (l, r, idc, c, ids) — c. 


Note that we have to define the function co mutually with the sets CTSeq s, 
i.e. the definition is by induction-recursion [9]. The idea here is that a list 
represents an initial part of a possible program execution. The identities ensure 
that the list is accurate for the interface. We need some auxiliary notions: 

Definition 5 (Last state, Predecessor) 

We denote the last state of the sequence l : CTSeq s by st A, i.e. st _ (c, ids) := 
s, st _ (7, r, idc, c, ids) : = nxt r. We denote the modified predecessor of the se¬ 
quence l by pd A, i.e. pd _ (c, ids) := (c, ids), pd _ (l, r, idc, c, ids) := l. 

Definition 6 (Append) 

We define mutually 


lo * (r, idc) * h : CTSeq s 

and an inhabitant of 


co Ai = co _ (Z 0 * {r, idc) * If) (1) 

for s : S, l 0 : CTSeq s, r : R, idc : cor = co Aq, h : CTSeq (nxt r) by 


l 0 * (r, idc) * (c, ids) := (Z 0 , r, idc, c, ids) 
l 0 * (r, idc) * (l, r', idc', c, ids) := (( l 0 * (r, idc) * l),r', idc", c, ids) 

where we obtain idd' from idd by the inhabitant of 1 which is defined as refl c 
in both cases. 

Note that definition by cases is necessary in the definition of the inhabitant 
of 1 since otherwise the terms would not evaluate. 

Proposition 7 (Associativity of append) 

lo * ( r 0 , idcf) * (Zi * (ri, idcf) * If) = ( lo * (r 0 , idc 0 ) * h) * (n, idc[) * l 2 

where idd x is obtained from idci by the inhabitant of 

co Ai = co _ ( l 0 * (r 0 , idcf) * If) 

due to 1. 
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Proof: Induction on l 2 . If 1 2 (c, ids) both sides of the equation evaluate to 

the same value. Let l 2 (l, r , idc, c, ids). 

Let Ci := co _/i, := co _ (Z 0 * (r 0 , idc 0 ) * If). 

Let lteft'-=lo*{ro, idc 0 ) * (h* (n, idcf)*t) and l r i g ht-= (k*(ro, idc 0 )kl x )k 
(ri, iddff -k l. By I.H. we have 


idl . lie ft lright- 

Let ci := co _ l, c\ := co_(Zi*(ri, idcfkl), c left := co J left , c right := co J right . 
We have inhabitants of 

Q Ci — Qe/t C[ — Cj-ight 


by which we obtain inhabitants 

idc[ : co r = c'i idci eft : co r = c ie f t idc right : co r = c right 
from idc. By idl we obtain a second inhabitant 
idc rig ht : co r = c right 

from idci e f t and with UIP C we conclude that idd right = idc right and 

(heft, idcieft) = (lright, id,C right ) (2) 

by Principle 2. Now l 0 * (r 0 , idco) * (h * (t\ idc x ) * l 2 ) evaluates to 

(heft, r, idcieft, C, ids ) 

and (7 0 * (ro, idc 0 ) * h) * (r l5 * l 2 to 


(lright , T, idc r i g fot) C, ids). 

The claim follows by 2 with Principle 1. 


□ 


Remark: Note that to conclude that 2 holds, we have to prove that idd right 
equals idc rig ht- We obtained idd right from idci e f t by shifting it along idl. Since 
we know nothing 6 about idl (we got idl from the I.H.) we know nothing about 
idd right . So to force the needed equality we apply UIP C. 

Corollary 8 


(c, ids 0 ) -k (r, idc) kl = (c, ids x ) k (r, idc) k l 
for ids 0 , idsi : (st c) — s. 

Proof: With UIP S. □ 

6 At least we do not know if types depending on idl are inhabited. 
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Corollary 9 


(co, ids 0 ) * (r, idc ) * / — (ci, idsi) * (r, idc') * l 
for id : Co = C\, ids^ : (st cf) = s (i = 0,1) and idc! = subst id idc. 

Proof: Case id = refl c. □ 

We are going to define a universe U. The definition is by induction-recursion 
[9]. The universe U is a relatively small universe. It contains names for the 
sets S, C, R and is closed only under the identity and sigma type formers. For 
the general role of universes in type theory and the proof theoretic strength 
gained by (much larger) universes compare [35,40]. 

Definition 10 (Universe) 

We define mutually 


U : Set 

= data NameS | NameC | NameR | 

Nameld (u : U)(ei, e 2 : set u) | NameSig (u : U)(/ : (e : set u) —> U) 


and 

set (u : U) : Set 
by 

set NameS 
set NameC 
set NameR 
set (Nameld u e\ e 2 ) 
set (NameSig u f ) 
We write NldC for Nameld NameC. 


S 

C 

R 

( e l = (set u) C 2 ) 

£(e : (set u).(set (/ e))) 


We want to define computation trees as functions T : CTSeq s —> U with the 
following properties: 


(1) There is exactly one root c : C for the tree. 

(2) For every l : CTSeq s which is a node of the tree and for every r : R suit¬ 
able for l there is exactly one successor, i.e. one c such that (l, r, idc, c, ids ) 
is a node of the tree. 

(3) For every l : CTSeq s which is a node of the tree the predecessor of l is a 
node of the tree too. 
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Where a list l is a node of the tree if set {Tl) is inhabited and r : R is suitable 
for / if cor = co A. Technically a computation tree will be a dependent tuple 
of a function T together with a witness that the function fulfills the properties 
above (Definition 12). The properties are expressed by sigma types (Definition 
11). We formalise this ideas as follows: 

Definition 11 For s : S, T : CTSeq s —*- U let dq s T be 
sig root : C 

id|* 0 : st root = s 

root ex : set (T(root, id, 0 )) 

root un i : Vc : C ,idsc : st c = s. set ( T (c, idsc)) =$■ c = root 

For s : S, T : CTSeq s —> U, l : CTSeq s, e : set (T V), r : R and 
idcr : co r = (co _/) let d> 2 s T l e r idcr be 
sig command : C 

id^ Q : st command = nxt r 

commandex : set (T(l,r,idcr, command, id^ Q )) 

command U ni : Vc : C, idsc : st c = nxt r. set (T {l, r, idcr, c, idsc)) 

c = command 

For s : S, T : CTSeq s —> U 7 l : CTSeq s and e : set (T l) let $ 3 s T l e 
be 


set (T(pd _Z)) 

Let $ s T be ($i sT) A ($ 2 s T) A ($ 3 s T ). 

Note the natural way in which we make use of dependent types in this def¬ 
inition: We quantify in $ only about those l which are nodes of the tree T: 
argument e : set (T l) in dq and d> 2 . This will play an important role later. 
We are now able to define the family of sets in the object part of the final 
coalgebra: 

Definition 12 (Computation trees) 


CT (s : S) : Set 
= sig tree : CTSeq s —> U 
phi : $ s tree 
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Before we define an equivalence relation on this family we declare the mor¬ 
phism of the final coalgebra. We single out the command of each tree by using 
the witness for the property $ 1 . 

Definition 13 (Command of a computation tree) 

For ct : CT s : with cf phi ip 2 , ¥ 3 ) 


co _cf := (fi root 
id^ Q _cf :=</?i, s 


The program that we obtain after doing one computation step and receiving 
a response r is represented by the subtree at branch r. A subtree is given by 
taking the tree function on another position. The argument is constructed by 
means of the append function on lists. 

Definition 14 (elim tree ) 

For ct : CT s, r : R and idc : co r = co _ ct let 

elim tree s ct r idc : CTSeq (nxt r) —> U 

given by 

XI : CTSeq (nxt r) . (ct tree ((c, ids) * (r, idc ) 
where c — co.ct and ids = idf Q _ ct. 

We need to prove that the defined function has the properties $i-d> 3 . 
Proposition 15 For ct : CT s, r : R and idc : (co r) = (co _cf) 

$1 (nxt r) (elim tree s ct r idc). 


Proof: Let c — co-d and ids = id l 0 ~ct. The inhabitant of $1 s ct t ree gives an 
inhabitant e : set(ct tre e s (c, ids)). The inhabitant of <f> 2 s ct t ree (c, ids) e r idc 
proves the claim. □ 

Proposition 16 For ct : CT s, r : R and idc : (co r) = (co _ct) 

$2 (nxt r) (elim tree s ct r idc). 


Proof: Let l : CTSeq (nxt r), e : set (elim tree s ct r idc l), r' : R, idc 1 : 
(co r') = (poA). Let c— co _ ct and ids = id l 0 ~ct. By 1 we get an inhabitant 
idd' : (co r') = (co_((c, ids) * (r, idc) * l) from idd and the inhabitant of 
$2 s ct tree ((c, ids) * (r, idc) ~k l) e r' idd' proves the claim. □ 
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Proposition 17 For ct : CT s, r : R and idc : (co r) = (co _ct) 


$ 3 (nxt r) (elim tree s ct r idc). 


Proof: Induction on l : CTSeq (nxt r). 


□ 


The morphism part of the final coalgebra is now given by: 


Definition 18 (dim) 

For ct : CT s we define 

elim s ct : Prog s CT 


by 


(co -d, idf Q _ct, next ei) 


where nextEi r idc : CT (nxt r) is given by elim tree s ct r idc and Propositions 
15-17 for r : R and idc : (co r) = (co _ct). 


We write nextEi ct for (elim _ct) nex t Er 


5.1 Bisimulation 


We still need to define an equivalence relation on CT. The function elim gives 
a labelled transition system. There is a transition r : R between trees T 0 and 
Ti if T x is the subtree of T 0 at branch r. Since this transition system is image 
finite we can define bisimulation by means of natural induction. 

Definition 19 (Bisimulation) 

For ct, ct' : CT s, n : N we define 

ct ~ n ct 1 : Set 


by 


ct ~zero ct' = True 

ct ~succ n ct' = sig idc : c = d 

fct : (r : R, idcr : (co r) = c) —► / r idcr ~ n f r idcr' 


and 


ct ~ ct' : Set 

= Vn : N. ct ct' 
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where elim s ct ( c,idc,f), elim s ct' (c', idc', f) and idcr' is obtained 
from idcr by idc. 

Proposition 20 ~ is an equivalence relation on CT. 

Proof: Straight forward. □ 

Proposition 21 


ct ~ ct 1 <£> elim s ct ~ Prog elim s ct 1 


for ct, ct' : CT s. 

Proof: “=>” Follows with UIP C. 

'%=” Trivial. □ 

Corollary 22 elim : CT —> Prog CT is extensional. 

This means that elim is a coalgebra morphism. We are going to prove, that 
elim : CT —> Prog CT is a final coalgebra for Prog. 


6 The unique morphism T into the final coalgebra 


Let B : S —> Set and g : (s : S, B s) —> Prog B s. We keep B,g fixed for 
the rest of the article. We write co -b, id^ 0 -b and nextEi s b for (g s b) c omman d, 
(g s b) id f o , (g s 6) ne xt E i respectively where b : B s. We must find a unique 
morphism T : B — ► CT with elim o T = Prog To g, i.e. elim s (T s b) ~p rog 
(Prog T) s (g s b) for s : S, b : B s. We get T by defining mutually the function 
value T tree s b l : U for l : CTSeq s and an element of B (nxt r) for those l 
which are nodes of T tree s b where r is a response of co_L This element is 
essentially the element which we get if we follow g along the responses which 
occur in l including r. The list (c, ids ) is a node of the tree T tree s b if c is the 
command played by g at b, i.e. (co _b) = c. The list (l.r. ,c,. ) is a node of 
the tree T tree s b if l is a node of T tree s b and c is the command played by g at 
the element of B (nxt r) described above. Things again become quite involved 
since we have to shift the identities to meet the typing requirements. 

Definition 23 We define mutually 

T tree sbl: U 


and 


A s b l r idc e : B (nxt r) 
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for s : S, b : B s, l : CTSeq s, r : R, idc : co r = co _/ and e : set (T tree sbl) by 
T tree s b (c, ids ) := NldC c (co _6) 

T tree s b (If r', idd, c, ids) := NameSig (T tree s b V)(\e : set(T tree s b l'). NldC c (d e)) 
where d e co _ (A s b V d idd e) and 


A s b (c, ids ) r idc e := nextEi s b r idee 
A s b (V, r', idd, c, ids) r idc e := next E i (nxt r') V r idd' 

where in the first case idee is the composition of idc and e, and in the second 

case b' A s b l' r' idd ef st , e sn d : c = (co -b') and idd' : = subst e snc i idc. 

We lift UIP C to set(T tree sbl): 

Proposition 24 

Vp, q : set(T tree sbl) =>• p = q 
for s : S, b : B s, l : CTSeq s. 

Proof: If l ( c,ids) this is UIP C. 

Let l ^ (l 1 , r, idc, c, ids), p,q : set(T tree sbl) with p ( p',idcp) and q 

(q',idcq). We have id : p' = se t(T sbl') d by I.H. and idep' = ideq by UIP C 

where we obtain idep' from idep by id. This proves the claim. □ 

Corollary 25 

A sbl r idc p = A s b l r idc q 

for s : S, b : B s, l : CTSeq s, r : R, idc : (cor) = (co J) and p,q : 
set (T tree S b l). 

Proof: Immediate from 24. □ 


The following three propositions state that T tree s b is indeed an element of 
CT, i.e. that T tree s b fulfils the properties 4>t — <f> 3 . 

Proposition 26 For s : S, b : B s 

$1 S (T tr ee S b). 


Proof: The following term proves the claim: 

(co _6, id^ -b, ref I (co _&), root un i T ) 

whereroot uniT c idsep := pfor c : C, idsc : (st c) = s andp : set(T tr ee s b ( c,idsc )). 

□ 
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Proposition 27 For s : S, b : B s 

$2 S (T tree S b). 

Proof: Let l : CTSeq s, p : set (T tree sbl), r : R, idcr : (co r) = (co J). 

For x : set(T tree s b l) let b' x := A s b l r idcr x, d x := co _(b' x) and 
ids' x := id^ 0 _ (b' x). The following term proves the claim 

(o' p, ids' p, (p, refl d p), command^) 

where command uniT c idsc q := subst id q snd and id : (/ fst = p the inhabitant 
according to Proposition 24 for c : C, idsc : stc = nxtr and q : set(T tree s b (lie 
{r, idcr)-k (c, idsc))). □ 

Proposition 28 For s : S, b : B s 

$ 3 S (Ttree S &)■ 

Proof: Obvious □ 

Definition 29 Let T(s : S)(b : B s) : CT s be 

(Ttree S 6, T phi s b) 

where T phi s b is given by the Propositions 26 - 28. 

We postpone the proof that T is extensional. 

7 The Repetition of the unique morphism T 

We want to prove that T is the unique morphism making the coalgebra square 
below commute. 

B - 9 -^ Prog B 

T I Prog T 

CT-► Prog CT 

elim 

That means we have to prove 

b 0 = bi =>• (Prog T o g) _b 0 ~ (elim o T) _b\ 
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for s : S and bo, b\ : B s, where = denotes the equivalence relation on B. We 
have 


ct 0 ~ n cti co _ cf 0 = co _cti and 

nextEi - ct 0 r 0 idcr 0 ~ n -i nextEi ci\ r 0 idcr' 0 
•O’... and 

nextEi - (nextEi ~ct 0 r 0 idcr 0 ) rq idcrq ~ n _ 2 
nextEi - (nextEi _cfi r 0 idcr-g) r% idcr[ 

< 0 ... 


for cf 0 , ct\ : CT s. This observation leads to the definition of the repetition 
T Rep of T which we use in the following to prove the coalgebra property. We 
define the repetition T Rep of T for every sequence l : CTSeq s which belongs 
to T tree s b. Essentially this will be the subtree of T tree which we get when we 
follow the tree along the path l. We want to define this by recursion on l. Again 
this can not be done in a straight forward way, since the elements we get by 
the induction hypothesis do not have the desired type. That means we have 
to shift them along certain identities which must be defined simultaneously. 
Therefore we define mutually 

T Rep sblp: CT(st J) 


and identities 


CO - l =c CO _ (TRep s b l p ) 
(T~R e p S b l p) tree l U Ttree ® b (Ifyl ) 


( 3 ) 

( 4 ) 


where s : S, b : B s, l : CTSeq s, p : set(T tree s b l ), V : CTSeq(st A) and 


(c, ids)#l' := V 

(. lo , r, idc, c, ids)#l' := ( l 0 * (r, idc) * l'). 

The second identity (in U) is needed to prove the first one (in C). 

Definition 30 (Repetition of T ) 

We define mutually 

T Rep (s : S )(b:Bs)(l: CTSeq s)(p : set(T tree s b l)) : CT (st J) 
by 

TRep s 6 (c, ids ) p = T sb 

T Rep s 6 {V r idc c ids ) p = nextEi - (T R ep sbl' p') r idc' 
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where p' = p 3 s b l p, <p 3 : <fr 3 s (T tree s b) as in Proposition 28 and idd 
obtained from idc by the identity 3. 

We define an inhabitant of 

co.I = co_(T Rep s bl p) 


by 

p if l = (c, ids) 

^lroot ■ cidsp ' if l = {V ,r,idc,c,ids) 

where : $1 _ (T Rep s b l p) as given by Proposition 26 and p' obtained from 
p by the identity f. 

To complete the definition we must define an inhabitant of 

(TRep Sblp) tree I' = T tree S b (10) 

for s : S, b : B s, l : CTSeq s, p : set(T s b l) and l' : CTSeq (st A). 

In the case l (c, ids ) an inhabitant of this type is given by 

refl (T tree s b {10)) 

since both sides of the equation evaluate to the same value. 

For l (7 0 , r, idc, c, ids) let p' as above, 


s 0 :=st J Q 

c to := co _ (T Rep s b l 0 jJ), 
idcsi 0 := id^ G _ (T Rep s b l 0 p'), 
sl 0 ( ci 0 ,idcsi 0 ), 

sli (c 0 , idcs 0 ), 

where l 0 — (..., c 0 , idcs 0 ) and idd obtained from idc by the identity 3. Let 


left = (T Rep s bl 0 p ')tree (slo * (r, idd) * V) 
middle = T tree s b ( l 0 #(sl 0 * (r, idd) * l')) 
right = T tree s b (l 0 * (r, idc) * l'). 


We must prove left = right. We have sl 0 * (r, idd) *1' = sli 
Corollary 9 and by I.H. 

left — middle. 


If lo (c 0 , idcs 0 ) then 


middle = right 


by Principle 1 and we are done. 

If lo (h, r 0 , idcr 0 , c 0 , idcs 0 ) then 


(r, idc) * V by 
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h * (r 0 , idcrf) * ( sl 0 * (r, idc) * /') = ii * (r 0 , idcr 0 ) * (sZi * (r, idc') * /') 

— (7i * (r 0 , idcr 0 ) * sli ) * (r, idc') * l' 

= l 0 * (r, idc') * f 

where t/ie first equation follows by Principle 1 and the second by the associa¬ 
tivity of*. Principle 1 gives 


middle = right 


and we are done again. 

Remark: Note that we could define the repetition of ct for arbitrary ct : CT s. 
Therefore we can proceed in a similiar way as above. We just need to replace 
p by (pi root . c ids p in the first case of the construction of the inhabitant of 
the identity 3 where ipi is the witness for s ct. However since this greater 
generality has no particular advantage for us we work with the definition 
above. 


As a corollary to Proposition 24 we get: 

Corollary 31 

T Rep s b l p = T Rep s b l q 


for p, q : T tree sbl. 

We need some auxiliary definitions. Let 


nxtS s (c, ids ) r := nxt r 
nxtS s ( l', r', idc, c, ids ) r := nxtS s V r' 

pred s (c', ids' ) r idc c ids := (c, ids) 

pred s (l', rf idc<f, ids') r idc c ids := ((pred s V r' idd d ids'),r, idcr, c, ids) 
where idcr is obtained from idc by the simultaneously defined inhabitant of 

c = co _ (pred s l r idc c ids) (5) 

which is given in both cases by refl c. Note that definition by cases is neces¬ 
sary again to define this inhabitant. The operation pred _ L cuts off the first 
command and response of the list l. Since this is only possible for fists of the 
form (l', r', idd, d, ids') we use the auxiliary arguments r, idc, c and ids. The 
obtained fist is an inhabitant of CTSeq (nxtS sir). Further we define an 
inhabitant of B (nxtS sir) by 

nexte s {d, ids') r idc c ids b ( id 0 , idf) := A s b (d, ids') r idc id 0 
nextB s ( l', r', idd, d, ids') r idc c ids b ( p', idf) := nexte s V r' idd d ids' b p' 


23 





where b : B s and p : set (T tree s b ( l,r,idc,c,ids )) for p (id 0 ,idi), 
p (p',idi) and l (d,ids'), l ( l',r',idd,d,ids') respectively. The in¬ 
habitant next B Jr. is calculated by doing essentially only the first step in 
the calculation of A _ l r _. Whereas A _ l r _ gives us an element of B (nxt r) 
by following all responses in l including r, next B / r is doing only the first 
step. The following Proposition states that we get equal elements in B (nxt r 0 ) 
whether we apply A on b and a sequence (l, r, idcr, c, idsc) or do one step from 
b along this sequence and use the sequence obtained from (l, r, idcr, c, idsc ) by 
pred above. 

Proposition 32 For s : S, l : CTSeq s, r,r 0 : R, c : C, b : B s, 

idcr : cor = co_ l 
idsc : st c = nxt r 
idcr 0 : co r 0 = c 

p : set (T tree s b (l, r, idcr, c, idsc)), q : set (T tree s n b n l p ) where 


s n = nxtS s l r 

b n = next B s l r idcr c idsc b p 
l p = pred s l r idcr c idsc 

we have 


A s b ( l,r, idcr, c, idsc) r 0 idcr 0 p = A s n b„ l p r 0 idcr' 0 q 
where idcr' 0 is obtained from idcr 0 by the identity 5. 

Proof: Case l ( d,ids ), p (id 0 ,idi). 

Then idcr' 0 evaluates to idcr 0 . Let idcr\, idcr 2 obtained from idcr 0 by id\, q 
respectively. By UIP C we have 


idcri = idcr 2 


and by Principle 1 we get 


A s b {{d, ids),r, idcr, c, idsc) r 0 idcr 0 ( id 0 , idf) = f idcri 

= f idcr 2 

= A s n b n l p r 0 idcr 0 q 

where / = (g (nxt r) ((g s b) nextEI r idcr')) nextB r 0 and idcr' obtained from idcr 
by id 0 . 

Case l {V, r', idd, d, ids), p fpf idi), q {q', id 2 ). 
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Then again idcr' 0 evaluates to idcr 0 . We define 

f : (x : B (nxt r)) —IdC x —> B (nxt r 0 ) 

where IdC x ((co r 0 ) — (co_x)) by 

f x y = (g (nxt r) x) ne xt EI r 0 y 

for x : B (nxt r), y : IdC x. 

By I.H. we have 

ih : A s b (l', r', idc ', d, ids ) r idcr p' = A s' n b' n l' p r idcr 2 q' 
leftJ) right b 

where idcr 2 is obtained from idcr by identity 5 and 

s' n := nxtS s V r' 

b' n := next B s V r' idcr'd ids b p' 
l' p := pred s V r' idcr'd ids. 

Let idcri, idcr :i obtained from idcr 0 by id\, id 2 respectively. By UIP C we get 
subst ih idcri = idcr 3 . 

That means 

(leftJ), idcri) — (right J), idcr 3 ) 
and by Principle 1 we get 

A s b (l, r, idcr , c, idsc ) r 0 idcr 0 p = f leftJ) idcri 
— f right Jb idcr 3 
= A s n b n l p r 0 idcr' 0 q 

□ 


Corollary 33 

co _ (A s b (l, r, idcr , c, idsc) r 0 idcr 0 p) = co _ (A s n b n l p r 0 idcd 0 q). 


Let s : S, l : CTSeq s, r : R, idcr : (co r) = (co_/), c : C, idsc : (st c) = (nxt r). 
We define an inhabitant of 

st _ (l, r, idcr , c, idsc) = st _ (pred s l r idcr c idsc) (6) 

by ref I (nxt r) according to the shape of l. Again definition by cases is nec¬ 
essary to define this inhabitant. The following Lemma will be our main tool 
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to prove all desired properties of T. Roughly speaking it says that we get the 
same trees whether we take the subtree following the tree at b along the path 
(l, r, idcr, c, idsc ) or do one step from b along this sequence (get a new b n ) and 
following the tree at b n along the path obtained from (l, r, idcr, c, idsc) by pred 
above. 

Lemma 34 (Main Lemma) 

Let s, l, r, c, b, idcr, idsc,p, q as well as s n , b n , l p as in Proposition 32. Then 

TRep 7 s b (l, r, idcr, c, idsc) p ~ T Rep s n b n l p q 

where we obtain the left term from T Rep s b (l, r, idcr, c, idsc) p by the identity 
6 . 

Proof: We have to distinguish cases l (c', ids) and l ( l', r', idd, d, ids) in 

order to have 

TRep 7 s b (l, r, idcr, c, idsc) p T Rep s b (l, r, idcr, c, idsc) p. 

However the proof proceeds in the same way in both cases: 

Let n : N. For n zero is nothing to do. Let n succ m. Let l + := 
{l, r, idcr, c, idsc) and 


c 0 := co _ (T Rep sbl + p) 
Ci ::= c 
c 2 :=co J p 

c 3 := co _ (T R ep s n b n lp q) 


We have 


where the first and last equation follow with the identity 3 and the second 
with the identity 5. 

Now let r 0 : R and idcr 0 : co r 0 = c 0 . For i = 0,1,2 we obtain elements 
idcri -|_i : cor 0 — c l+ \ from idcri by the identities above. Further we obtain 
a second element idcr' 0 : co r 0 = c 0 from idcri and a second element idcrf : 
co r 0 — c 3 from idcr 0 . We have idcr 0 — idcr' 0 and ?'dcr 3 — idcr' :i 7 . Let 


nxtdft := nextEi - (T Rep sbl + p) r 0 
nxt_rgt := next E i _ (T Rep s n b n l p q) r 0 

and ct 0 nxtdft idcr' 0 , ct\ := nxtdft idcr 0 , ct 2 nxt rgt idcr 3 , 
ct 3 := nxt_rgt idcr' 3 . We have ct 0 = ct\ and ct 2 = ct, :i . We have to prove 

7 We do not need UIP C for this. 
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cti ~ m ct 3 . Therefore it is enough to prove 
ct 0 cf 2 . 

Let 

c p := co _ (A s b l + r 0 idcri p ), 
c p J,d := id ^ 0 _ (A s b l + r 0 idcri p) 
idc p given by identity 5. 

We have 

{p, refl c p ): set(T tree s b (l + , r 0 , idcri, c p , c p Jd)) 

(q, idcp): set(T tree s n b n (pred s l + r 0 idcri c p c p id)) 

and 

ct 0 TRep 's b ( l + , r 0 , idcri, c p , c p Jd) (p, refl c p ) 

ct 2 T Rep s n b„ (pred s l + r 0 idcri c p c p Jd) ( q,idc p ). 

Therefore the claim follows by I.H. applied to s : S, l + : CTSeq s, r 0 : R, 
c p : C, b : B s, idcri : co r 0 = c, c p J,d : st c p = nxt r 0 , (p, refl c p ), ( q, idc p ) and 
m : N. □ 

Corollary 35 For s : S, b : B s, r : R, idcr : (co r) = co_(T s b), we have 

(elim s(Ts &))„ext EI r idcr ~ ( Pr °g T s (g s b)) nextB r idcr. 

Proof: Apply the Main Lemma to s, (c 0 , ids 0 ), r, Ci, b, idcr, idsi, (refl c 0 , refl c 2 ), 
refl C 3 where 

c 0 := co _ (T s b) 
ids 0 := id^o _(T s b) 

Ci := co _ (next E i _ (T s b) r idcr ) 
idsi := ide 0 _ (next E i _ (T s b) r idcr) 
c 2 := co _ (A s b (c 0 , ids 0 ) r idcr (refl c 0 )) 
c 3 := co _ ((g s b) nextEI r idcr). 

D 

Note that (Prog T s (g s b )) nextEI r idcr T (nxt r) {{g s 6 ) ne xt E i f idcr). 
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8 Proof of the Final Coalgebra Property 


Proposition 36 If g is extensional, then T is extensional. 

Proof: We denote the equivalence relation on B by = and the witness that g 
is extensional by ext. The proof is by natural induction. Let s : S, bo, b\ : B s, 
rel : b 0 = bx, n ^ succ m : N. Let 


c 0 := co _ (T s b 0 ) 

Ci := co _ (T s bi) 
left Tun := (g s b 0 ) next E , 
right Tun :=(g s h) nextB 

id := (ext s b 0 bi rel) ldc : c 0 = C\ 


The term id gives the first component of the inhabitant we have to construct. 
For the second component let r : R, idcr : (co r) = c 0 . We have to prove 

(elim s(T s &o))next E i r ^ cr (elim s(T s &i)) n ext E i r ^ cr ' 

where idcr' := subst id idcr. Let b' Q := leftJun r idcr, b\ := right_fun r idcr' 
then (ext s b 0 b\ rel) f ct r idcr gives b' 0 = b\ and by I.H. we have 

T (nxt r) b' 0 T (nxt r) b[. 

The claim follows with Corollary 35. □ 

Lemma 37 

elim o T = Prog To g 

Proof: Let s : S, b 0 ,bi : B s, rel : b 0 = b\, c 0 := ((elim oT) s 5o)command, 
ci := ((Prog T o g) s &i) C ommand- It is id :— ext s b 0 b\ rel : c 0 — fij. Let n : N, 
r : R and idcr : (co r) = c 0 . Then follows 


((elim oT)s f> 0 )next E , r idcr~ n ((Prog T o g) s b Q ) ne xt EI r idcr' 

~n ((Prog T og)sb 1 ) next El r idcr' 

where idcr' := subst id idcr and the first relation follows by Corollary 35 and 
the second by the extensionality of g and Prog T. □ 

Lemma 38 For T' : B —> CT with 

elim oT'= Prog T' o g 


we have V — T. 
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Proof: Natural induction. Let s : S, b 0 , b\ : B s, rel : b 0 = b\, n succ m : N. 
Let comm : elim oT' = Prog T' o g , c 0 := ((elim o T') s &o)command, Ci ■— 
((elim o T) s 5i)command- Then 

id := (comm s b 0 h rel) lc j c : c 0 = c\. 

Let r : R and idcr : (co r) — c 0 then 


(T' s 6 0 )next EI r idcr ~ n T' (nxt r) ((g s &i) ne xt EI r idcr') (7) 

T (nxt r) ((g s 6i) ne xt EI r idcr') (8) 

~ n (T s &i)next EI r idcr' (9) 

where idcr' := subst id idcr. The relation 7 follows by (comm s b 0 b\ rel) f ct r idcr, 
the relation 8 by the I.H. and the fact that = is reflexive and the relation 9 
by Corollary 35. □ 

Theorem 39 elim : CT —>• Prog CT is a final coalgebra for Prog 

Proof: Lemmata 37 and 38. □ 


9 Carry over the Result to the original Functor of Hancock/Setzer 


In this section we are going to translate the result to the original functor 
Prog H s °f Hancock/Setzer above. We first notice that we can write an uncur¬ 
ried version of the functor Prog as 


Prog uc X s := ^2(p. (FamToPred' st) s, 

(q : (FamToPred' co) p fst ) -> X (nxt g fst )). 

We can prove a final coalgebra theorem for this functor in the same way 
as above (this is just a rearrangement of parentheses). If (S, C, R, st, co, nxt) 
comes from an Hancock/Setzer-interface (S,C, R,n) as described in section 
2.4, Prog uc X s rewrites to 

E (P : E(«c : E(S, C), (st sc) - s), 

{q : E(scr : E(E(S, C), R'), (co scr) Pfst)) -♦ X (nxt r/ fst )). 

where st and co are the first projections and R' is the uncurried version of R. 
We define functions 


u_hs : Prog uc X s —> Prog HS X s 
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by 


{{(s',c),id),f) i-> (d,f) 

where d := subst id c, /' r := / (((s,d),r),id ') and id' : (s, c') = (s',c) 
defined by structural induction on id : s' = s and 

hs u : Prog HS Prog uc X s 


by 


(c,/> ^ (((s,c),refl s),f) 


where fp = (subst p snd /) p fst . 

We have p u_hs (hs_u p) and therefore p = u_hs (hs_u p). We define 
equivalence relations — on Prog uc X s by 


(. scid 0 ,f 0 ) = (scidi,fi) :<t^> 3id : scid 0 = scidi.pointeq (/g id) fi 


where f Q id := subst id f 0 and pointeq (/g id) fi expresses that (/g id), /i are 
pointwise equal. By structural induction on id follows that we have 


— C —Prog 

for arbitrary equivalence relations = on X. Further we have 

Proposition 40 

p = hs_u (u_hsp) 

for p : Prog uc X s. 

Proof: Let p {((s', d),ids), /). We prove 

(((s' ,d),ids), f) = hs_u (u_hs (((s' ,d),ids), /)) 
by structural induction on ids. That means we have to prove 
(((s, d), refl s), f) — hs_u (u_hs (((s, d), refl s), /)). 

We get an inhabitant of this type by setting the first component 
refl ((s, d), refl s ). 

The second component must now have type 

pointeq / (hs_u (c,/')) snd 

where /' := Ar : R! (s,d).f (((s,d),r), refl ( s,d)). Let sd : J2(S,C) and 
((sc, r), idsc) : : J2(12(S, C), R'), scrf st =^s,c) sc ')■ By structural in¬ 

duction on idsc we get 

/ ((sc, r), idsc) = (subst idsc /") r 
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where /" := Ar : R' sc' .f ((sc', r), refl sc'). By setting sc' = (s, c') we get 


/ (( sc,r),idsc ) = (hs_u (c, /')) sn d ((sc, r), idsc). 


□ 


Corollary 41 


P = Prog hs_U (u_hs p) 


/or p : Prog uc X s. 

To view Prog HS as a functor in our category we must say what Prog HS is doing 
on the equivalence relations Eonl. Therefore we define 


P =Pro gHS ? (hs u p) = Prog (hs_u q). 
hs u, u hs are extensional in respect of this relations and we have 
hs_u(u_hs p) = Prog p u_hs(hs_u q) = ProgHS Q, 
i.e. Prog uc X s and Prog HS X s are isomorphic in our category. We have 
UIP S, UIP C ^ UIP S A Vs : S. UIP C s. 


Therefore we get 

Theorem 42 If UIP S' A Vs : S.UIP C s then u.hsoelim : CT —> Prog HS CT is 

a final coalgebra for Prog HS . 


10 Related and future work 


As we have seen, working in intensional type theory becomes quite compli¬ 
cated. The dependency on proof objects for simple equations results in an 
intricate argumentation. We also needed the principle UIP for the sets S, C for 
our proof to go through. So, what did we gain by the result above? First of 
all as already mentioned the result can be seen as a justification for the rules 
of Hancock/Setzer if we replace definitional equality by bisimulation and have 
UIP for the sets S, C. We are convinced that replacing definitional identity by 
bisimulation is not a serious restriction as long as we are mainly interested in 
the behaviour of programs. Results such as those in Michelbrink/Setzer [33] 
that the monad rules hold should be provable with the altered rules. There is 
also an advantage if we want to prove facts about the behaviour of concrete 
interactive programs: We proved that the functor Progns has a final coalge¬ 
bra whereas the rules of Hancock/Setzer give us a weakly final coalgebra only 
(uniqueness is missing). This should outweigh that concrete interactive pro¬ 
grams are given by extensional functions X —> Prog X whereas in the approach 
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of Hancock/Setzer any such function is sufficient. Sets S, C with UIP S, UIP C 
may as well be sufficient for practical work. However from a theoretical point 
of view this restriction is unsatisfactory. It would be nice to improve the above 
result by getting rid of these conditions. However the type theory enriched by 
the rules for a weakly final coalgebra as described in e.g. [33] results in far 
more elegant proofs. Note also that more types become definitional equal by 
these rules whereas two types which depend on bisimular programs do not 
have to be equal. Secondly a deeper analysis of the proof above and a com¬ 
parison with proofs in other frameworks may shed some light on why working 
in intensional type theory is so hard. The same final coalgebra construction is 
already carried out in ZFC [33] and Gambino/Hyland [13] proved an initial 
algebra theorem in extensional type theory. The problem of representing final 
coalgebras in type theory was addressed by Lindstrom [26] for the special case 
of Aczel’s non-wellfounded sets. Lindstrom used an inverse-limit construction 
that requires extensional type theory. What can be said already is that the 
lack of a good concept for subsets as in set theory complicates work. Note 
that the subset theory discussed in Nordstrom et al. [34] may be of less or no 
help as long as we work in an intensional setting [38,37]. We think that Luo’s 
coercive subtyping [27] may at least be a way to get crisper formulations. 
There is an increasing interest in approaches to reason in dependent type the¬ 
ory about imperative programming, interaction, non termination and general 
recursion. We would like to mention recent work of Michael Abbott, Thorsten 
Altenkirch, Neil Ghani and Conor McBride on containers [1,4,2,3]. The exten¬ 
sion of a container (the result of applying the container construction functor 
to a container) is a special variant of our functor Prog HS . More precisely a 
container with parameters is a state dependent interface with trivial n where 
the command sets do not depend on the state. A main difference to our work is 
that Abbott et al. work in an extensional type theory (the identity type is given 
by equalisers). In fact they require their ambient category to be locally carte¬ 
sian closed, with disjoint coproducts, W- and M-sets. Geuvers [12] investigated 
formalisations of inductive and coinductive types in different lambda calculi, 
mainly extensions of the polymorphic lambda calculus. He showed that by 
adding a categorical notion of (primitive) recursion, recursion can be defined 
by corecursion and vice versa using polymorphism. Thierry Coquand proposed 
in [7] to add a guarded proof induction principle to type theory to reason about 
infinite objects. He gives a syntactical criterion to ensure that every term has 
a head normal form. Gimenez, E. [14] formalised an extension of the Calculus 
of Construction with inductive and coinductive types using similar ideas. In 
Venanzio Capretta’s [5] Ph.D. thesis coinductive types are added to Martin- 
Lof type theory with bisimulation as equality. Jean-Christophe Filiatre [10] 
interpreted Hoare triples for a programming language with both imperative 
and functional features in the Calculus of Inductive Constructions and proved 
a correctness result. There is ongoing work following the line initiated by Pe¬ 
ter Hancock and Anton Setzer [16-19,15,33,23] on reasoning about interfaces 
and programs using ideas from category theory and functional programming, 
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linear logic, game theory, refinement calculus and formal topology. Interfaces 
can be seen as objects in different categories and there are many interesting 
monads, comonads, adjoint situations and equivalences. In the authors paper 
[32] the notion of interfaces is generalised and simplified. With this simplified 
notion the relationship of interfaces to games becomes apparent. Stateless net¬ 
works like the internet are a natural application area for this simplified notion. 
As shown by Hancock/Hyvernat [15] interfaces (interaction structures) seen 
as predicate transformers give a connection to formal topology [39]. In fact 
every interface gives a natural example for a non distributive topology. This 
gives as well a (until now rather vague) interpretation of safety and liveness 
properties of programs [25]. In [23,24] Hyvernat uses interfaces to give a model 
of linear logic. 
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